Release Announcements
=====================
-This is the first release candidate of Samba 4.18. This is *not*
+This is the first pre release of Samba 4.21. This is *not*
intended for production environments and is designed for testing
purposes only. Please report any defects via the Samba bug reporting
system at https://bugzilla.samba.org/.
-Samba 4.18 will be the next version of the Samba suite.
+Samba 4.21 will be the next version of the Samba suite.
UPGRADING
=========
+LDAP TLS/SASL channel binding support
+-------------------------------------
-NEW FEATURES/CHANGES
-====================
-
-More succinct samba-tool error messages
----------------------------------------
+The ldap server supports SASL binds with
+kerberos or NTLMSSP over TLS connections
+now (either ldaps or starttls).
-Historically samba-tool has reported user error or misconfiguration by
-means of a Python traceback, showing you where in its code it noticed
-something was wrong, but not always exactly what is amiss. Now it
-tries harder to identify the true cause and restrict its output to
-describing that. Particular cases include:
+Setups where 'ldap server require strong auth = allow_sasl_over_tls'
+was required before, can now most likely move to the
+default of 'ldap server require strong auth = yes'.
- * a username or password is incorrect
- * an ldb database filename is wrong (including in smb.conf)
- * samba-tool dns: various zones or records do not exist
- * samba-tool ntacl: certain files are missing
- * the network seems to be down
- * bad --realm or --debug arguments
+If SASL binds without correct tls channel bindings are required
+'ldap server require strong auth = allow_sasl_without_tls_channel_bindings'
+should be used now, as 'allow_sasl_over_tls' will generate a
+warning in every start of 'samba', as well as '[samba-tool ]testparm'.
-Accessing the old samba-tool messages
--------------------------------------
+This is similar to LdapEnforceChannelBinding under
+HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
+on Windows.
-This is not new, but users are reminded they can get the full Python
-stack trace, along with other noise, by using the argument '-d3'.
-This may be useful when searching the web.
+All client tools using ldaps also include the correct
+channel bindings now.
-The intention is that when samba-tool encounters an unrecognised
-problem (especially a bug), it will still output a Python traceback.
-If you encounter a problem that has been incorrectly identified by
-samba-tool, please report it on https://bugzilla.samba.org.
-Colour output with samba-tool --color
--------------------------------------
+NEW FEATURES/CHANGES
+====================
-For some time a few samba-tool commands have had a --color=yes|no|auto
-option, which determines whether the command outputs ANSI colour
-codes. Now all samba-tool commands support this option, which now also
-accepts 'always' and 'force' for 'yes', 'never' and 'none' for 'no',
-and 'tty' and 'if-tty' for 'auto' (this more closely matches
-convention). With --color=auto, or when --color is omitted, colour
-codes are only used when output is directed to a terminal.
+LDB no longer a standalone tarball
+----------------------------------
-Most commands have very little colour in any case. For those that
-already used it, the defaults have changed slightly.
+LDB, Samba's LDAP-like local database and the power behind the Samba
+AD DC, is no longer available to build as a distinct tarball, but is
+instead provided as an optional public library.
- * samba-tool drs showrepl: default is now 'auto', not 'no'
-
- * samba-tool visualize: the interactions between --color-scheme,
- --color, and --output have changed slightly. When --color-scheme is
- set it overrides --color for the purpose of the output diagram, but
- not for other output like error messages.
+If you need ldb as a public library, say to build sssd, then use
+ ./configure --private-libraries='!ldb'
-No colour with NO_COLOR environment variable
---------------------------------------------
+This re-integration allows LDB tests to use the Samba's full selftest
+system, including our knownfail infrastructure, and decreases the work
+required during security releases as a coordinated release of the ldb
+tarball is not also required.
-With both samba-tool --color=auto (see above) and some other places
-where we use ANSI colour codes, the NO_COLOR environment variable will
-disable colour output. See https://no-color.org/ for a description of
-this variable. `samba-tool --color=always` will use colour regardless
-of NO_COLOR.
+This approach has been demonstrated already in Debian, which is already
+building Samba and LDB is this way.
-New wbinfo option --change-secret-at
-------------------------------------
+As part of this work, the pyldb-util public library, not known to be
+used by any other software, is made private to Samba.
-The wbinfo command has a new option, --change-secret-at=<DOMAIN CONTROLLER>
-which forces the trust account password to be changed at a specified domain
-controller. If the specified domain controller cannot be contacted the
-password change fails rather than trying other DCs.
+LDB Module API Python bindings removed
+--------------------------------------
+The LDB Modules API, which we do not promise a stable ABI or API for,
+was wrapped in python in early LDB development. However that wrapping
+never took into account later changes, and so has not worked for a
+number of years. Samba 4.21 and LDB 2.10 removes this unused and
+broken feature.
REMOVED FEATURES
================
Parameter Name Description Default
-------------- ----------- -------
+ ldap server require strong auth new values
KNOWN ISSUES
============
-https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.18#Release_blocking_bugs
+https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.21#Release_blocking_bugs
#######################################
git.samba.org / samba.git / blobdiff